Add OIDC publish workflow for npm provenance (#7)

* 🚀 ci: add OIDC publish workflow for npm provenance

Enables npm publish with OIDC provenance on GitHub release.
Uses id-token:write permission and --provenance flag for
supply chain security. Modeled after rootly-ts publish workflow.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* 🔒️ fix: remove NPM_TOKEN in favor of OIDC trusted publishers

No secret needed — npm auth handled entirely via OIDC id-token.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* 🔧 chore: remove registry-url to allow OIDC auto-detection

setup-node's registry-url writes .npmrc with empty NODE_AUTH_TOKEN,
which blocks npm's OIDC trusted publisher auto-detection. Removing
it lets npm CLI use OIDC directly.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* 🔧 chore: install latest npm for OIDC trusted publisher support

Ensures npm CLI version supports OIDC auto-detection for
provenance publishing without explicit token configuration.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* 🔧 chore: add Dependabot config for npm and GitHub Actions

Weekly dependency updates on Wednesdays for both npm packages
and GitHub Actions, with minor/patch grouping.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: kwent

.github/dependabot.yml

@@ -0,0 +1,36 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+      time: "06:00"
+    assignees:
+      - "kwent"
+    labels:
+      - "dependencies"
+    open-pull-requests-limit: 20
+    cooldown:
+      default-days: 3
+      semver-major-days: 7
+    groups:
+      minor-and-patch:
+        applies-to: version-updates
+        update-types:
+          - "minor"
+          - "patch"
+        patterns:
+          - "*"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "wednesday"
+      time: "06:00"
+    assignees:
+      - "kwent"
+    open-pull-requests-limit: 20
+    cooldown:
+      default-days: 3

.github/workflows/publish.yml

@@ -0,0 +1,23 @@
+name: Publish
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 24
+      - run: npm install -g npm@latest
+      - run: corepack enable
+      - run: yarn install --immutable
+      - run: yarn build
+      - run: npm publish --provenance --access public